In the Btrfs filesystem, a bug in the free space cache loader allows a crafted cache that advertises more entries than pages to be loaded because the loader uses the on‑disk num_entries field without validating it against the number of allocated pages. During checksum verification this results in an out‑of‑bounds read that is treated as a page structure, triggering a general protection fault or kernel panic. The immediate effect is a kernel memory corruption that can cause a denial‑of‑service via a system crash. No privilege escalation is described in the CVE details.

The vulnerability exists in all Linux kernels that include Btrfs support and have not yet incorporated the patch that adds the bounds check to __load_free_space_cache. Because no specific version range is provided, any kernel prior to the fix is potentially vulnerable. The flaw is inherent to the Btrfs file‑system code and is therefore present on all distributions that ship Btrfs in the kernel.

Exploitation requires the attacker to create or modify a free space cache on a Btrfs volume, meaning write access to the volume and a local attack context. The CVSS and EPSS scores are not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no public exploit is known. Nonetheless, a successful local exploitation would cause a kernel panic, effectively denying service to the affected system.